SMS4 - Northern Kentucky University

4 JEREMY ERICKSON, TAYLOR UNIVERSITY
2.3. The SMS4 Key Schedule. We define a vector (Yi, Yi+1, Yi+2, Yi+3) ∈ (GF(2) 32 ) 4
as the key schedule input to round i.
Denote the input key as (K0, K1, K2, K3). Then
Y0 = K0 ⊕ 0xa3b1bac6
Y1 = K1 ⊕ 0x56aa3350
Y2 = K2 ⊕ 0x677d9197
Y3 = K3 ⊕ 0xb27022dc
Also denote CKi = (cki,0, cki,1, cki,2, cki,3) ∈ (Z 8 2) 4 where cki,j = 28i + 7j
mod 256, represented in binary.
Then
(5) RKi = Yi+4 = Yi ⊕ L ′ (S(Yi+1 ⊕ Yi+2 ⊕ Yi+3 ⊕ CKi))
2.4. The SMS4 Round Function. We define a vector (Xi, Xi+1, Xi+2, Xi+3) ∈
(GF(2) 3 2) 4 as the input to round i, numbering the rounds from 0. Thus, (X0, X1, X2, X3)
represents the plaintext. Then,
(6) Xi+4 = Xi ⊕ L(S(Xi+1 ⊕ Xi+2 ⊕ Xi+3 ⊕ RKi))
The output of the last four rounds is reversed (at the word level) to generate the
ciphertext. Thus, the ciphertext is (X35, X34, X33, X32).
3. Simplified SMS4
To provide for some basic exploration of the behavior of algebraic attacks over
a larger number of rounds, as well as to provide a form of SMS4 that can be
worked out by hand, this paper proposes a simplified SMS4 algorithm, which will
be referred to from here as S-SMS4.
The basic operations of S-SMS4 are identical to full SMS4, except that all operations
on 128-bit blocks become operations on 32-bit blocks, operations on 32-bit
words become operations on 8-bit “words”, and operations on 8-bit bytes become
operations on 4-bit nibbles.
3.1. The S-SMS4 S-box. The S-box of SMS4 was designed from the description
of the full SMS4 S-box in [9]. The new S-box is designed to transform a 4-bit vector
to another 4-bit vector, but otherwise follows equation 1 plus reversing input and
output. Thus, a smaller cyclic matrix is the basic A with its bottom row as the
row vector for C. Thus,
A =
⎡
⎢
⎣
1 1 1 0
0 1 1 1
1 0 1 1
1 1 0 1
C = (1, 1, 0, 1)
Accounting for the reversal and using the form of equation 2, however, we derive
the following matrices in a similar manner:
⎡
0 1
⎢
A1 = ⎢ 1 1
⎣ 1 1
1
1
0
1
0
1
⎤
⎥
⎦
1 0 1 1
⎤
⎥
⎦